SOC 2 Analyst

Position Overview

SOC 2 Contract through 2026 Supporting APAC Time zones.

Responsibilities

• Investigate security incidents and determine root causes.
• Review incidents escalated by Tier 1 analysts, who collect data and review alerts.
• Utilize threat intelligence—including indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and company host, network data sets—to assess alerts, threats, and potential incidents in depth.
• Develop and refine SIEM use cases, reduce/tune false alerts, and lead investigations until issues are resolved.
• Monitor systems and events across Windows, macOS, and Linux operating systems.

Qualifications

• Proactive, problem‑solver, and curious.
• 5+ years recent experience as a Tier 2 or Tier 3 analyst at a large organization; preference for government and critical‑infrastructure companies.
• Strong, demonstrated SIEM and data correlation experience.
• Experience designing new SOC use cases and working with vendors to implement them.
• Experience designing and implementing runbooks to mitigate security incidents.
• Experience designing incident‑response plans, including alert definitions, runbooks, and escalation procedures.
• Extensive experience reviewing and managing alerts in Microsoft Defender, Splunk, and/or CrowdStrike.
• Proficient in conducting hunts across disparate data sets—host, vulnerability, threat, network, and Active Directory data—to identify threats.
• Leadership in timely security‑operations response efforts in collaboration with stakeholders.
• Documentation of incident‑response communications for technical and management audiences.
• Ability to set up alert rules and manage alerts effectively.
• Demonstrated ability to create runbooks and conduct investigations with key application, IT infrastructure, and other stakeholders.
• Experience designing custom SOC SIEM use cases in Defender, Splunk, and CrowdStrike.
• Experience conducting forensic investigations.
• Analytical, qualitative, and quantitative abilities.
• Adaptive to dynamic environment.
• Strong security‑operations documentation abilities.

#J-18808-Ljbffr